PT-2026-26831 · WordPress · Post Affiliate Pro

Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-2290

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Post Affiliate Pro versions prior to 1.28.1

Description The Post Affiliate Pro plugin for WordPress is susceptible to Server-Side Request Forgery (SSRF). This allows authenticated attackers with Administrator-level access to initiate arbitrary outbound requests from the application and read the returned response content. Successful exploitation has been confirmed by receiving and observing response data from an external Collaborator endpoint.

Recommendations Update Post Affiliate Pro to version 1.28.1 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-2290

Affected Products

Post Affiliate Pro

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-2290 · Security Note
• https://plugins.trac.wordpress.org/browser/postaffiliatepro/trunk/Base.class.php#L127 · Note
• https://plugins.trac.wordpress.org/browser/postaffiliatepro/tags/1.28.0/Base.class.php#L127 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/369cd6ca-bb36-479e-b342-36d2ca778ce1?source=cve · Note
• https://twitter.com/CVEnew/status/2035237295532777804 · Twitter Post